Honeypot test

This help section describes the Honeypot feature and the related settings available under the BlacklistsHoneypot Test page in the navigation.

General Information

Honeypots are email addresses that act as traps set to detect spamming. When an email is sent to a honeypot address, the test temporarily bans the sender by its IP address. This test operates on the assumption that no legitimate sender will ever send emails to a honeypot. Thus, anyone sending to a honeypot is a spammer.

Enabling or Disabling the Honeypot Test

You can enable or disable the use of the Honeypot Test on the FilteringTests page in the navigation.

Using the Honeypot Test

Database button

See the Database Settings Dialog topic.

Honeypot addresses

Edit the list of honeypot addresses by clicking the Edit button in the Honeypot Addresses group. To learn how to set up honeypots, read our article.

Blacklist for...

Enter the number of minutes for how long sender IPs remain blacklisted for honeypot delivery attempts.

IP Exceptions

Add the IP address of senders that must not be blacklisted by this test.

Sender Exceptions

Add email addresses of senders that must not be blacklisted by this test.

By default, this list contains two items, both are for detecting Delivery Status Notifications (DSNs). We recommend that you keep these two items to prevent false positives due to backscatter. Consider that your honeypot (or other) addresses may be used as sender addresses for spamming. In this case, poorly configured, but otherwise legitimate MTAs will try to send DSNs to the honeypot addresses and thus would get blacklisted.

Validate the sender before excluding the email from filtering

Use this to verify whether the sender is actually authorized to send emails on behalf of the domain it claims to represent and not just spoofing it to bypass filtering: If the sending domain has a published SPF policy, the email must "pass" the SPF evaluation to be excluded from filtering.